SQL6-D0-012900 - SQL Server must be able to generate audit records when successful and unsuccessful attempts to access security objects occur.

Information

Changes to the security configuration must be tracked.

This requirement applies to situations where security data is retrieved or modified via data manipulation operations, as opposed to via specialized security functionality.

In an SQL environment, types of access include, but are not necessarily limited to:
SELECT
INSERT
UPDATE
DELETE
EXECUTE

To aid in diagnosis, it is necessary to keep track of failed attempts in addition to the successful ones.

Satisfies: SRG-APP-000492-DB-000332, SRG-APP-000492-DB-000333

Solution

Deploy an audit to audit the retrieval of privilege/permission/role membership information when successful and unsuccessful attempts to access security objects occur.

See the supplemental file 'SQL 2016 Audit.sql'.

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_MS_SQL_Server_2016_Y24M07_STIG.zip

Item Details

Category: AUDIT AND ACCOUNTABILITY

References: 800-53|AU-12c., CAT|II, CCI|CCI-000172, Rule-ID|SV-213995r961791_rule, STIG-ID|SQL6-D0-012900, STIG-Legacy|SV-93957, STIG-Legacy|V-79251, Vuln-ID|V-213995

Plugin: MS_SQLDB

Control ID: 275c8557f80cad70c18b713b3cc82162ff15521a0f65859518142bf714052e13